Harden CI pipeline (pinned SDK + matrix + cache)

[nanaf6203-bit]

Problem Statement

• The soroban-sdk dep is pinned to "22.0.0" only by version; no SHA
  pin.
• CI runs only on nightly. There's no matrix including stable.
• soroban CLI optimization is conditional and silently skipped.

Why it matters
A surprise release of soroban-sdk 23 can break the build late on a
Friday. CI should give early warning.

Acceptance Criteria

• Pin soroban-sdk by SHA in Cargo.lock via cargo update --precise.
• CI matrix: {nightly, stable} × {sdk-pinned, sdk-latest-in-22.x}.
• soroban CLI install step in CI (replace conditional).
• Cache soroban/stellar binaries.

Files/Modules Likely Affected

• .github/workflows/ci.yml
• .github/workflows/deploy.yml
• Cargo.lock (committed)
• Makefile

Difficulty Hard. Estimated Effort M.

Labels
area:ci, area:smart-contract-safety, priority:high

---

Imported from docs/open-issues-draft.md as draft issue #38 (commit 7becd4b). Original draft-order cross-references in this body have been remapped to current GitHub issue numbers at import time.

[GBOYEE]

Hi team — I'd like to take this on as part of the GrantFox campaign. I'll implement the SDK helper and open a PR shortly.

[OlaGreat]

I'd like to take this on. I'm a software engineer with experience in blockchain, backend systems, and open-source contribution. I've reviewed the issue and I'm confident I can deliver a clean implementation with tests covering the acceptance criteria. Happy to follow the project's existing conventions.

[grantfox-oss]

🦊 GrantFox — @OlaGreat has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #98)
2. Your PR will be reviewed by the StellarTips maintainers

Good luck! Track your progress on GrantFox.